Data Tunnels

Services are reachable only through authenticated channels, preventing unauthenticated scanning and external access.

Property	Traditional Network	Enigma Tunnels
Discoverability	Services announce themselves	Nothing visible until authenticated
Routing	Stable paths, cacheable	Paths change every epoch
Endpoints	Fixed IPs, known ports	No exposed endpoints

The pseudocode below illustrates the high-level steps used to establish an authenticaed tunnel.

// TUNNEL ESTABLISHMENT PSEUDOCODE

function establishTunnel(user, targetService):
    // Phase 1: Authentication (BEFORE any network access)
    identity = user.getCertificate()
    if not verifyIdentity(identity):
        return REJECT  // No unauthenticated access

    // Phase 2: Policy Check
    policy = controller.getPolicy(identity, targetService)
    if not policy.allows(identity, targetService):
        return UNAUTHORIZED

    // Phase 3: Route Calculation (epoch-dependent)
    currentEpoch = getCurrentEpoch()
    availableRouters = getRoutersForEpoch(currentEpoch)
    route = calculateRoute(user.location, targetService, availableRouters)

    // Phase 4: Session Key Derivation
    ephemeralKey = generateECDHKeyPair()
    sessionKeys = deriveSessionKeys(ephemeralKey, targetService.publicKey)

    // Phase 5: Encrypted Tunnel
    tunnel = createEncryptedChannel(route, sessionKeys)

    return tunnel

function onEpochBoundary(tunnel, newEpoch):
    // Route rotation without dropping connection
    newRoute = calculateRoute(tunnel.user, tunnel.service, newEpoch)
    tunnel.migrateRoute(newRoute)
    tunnel.rotateSessionKeys()  // Forward secrecy